The meeting interface may look convincing, but the hostname, sign-in destination and unexpected download path expose the deception.
The scenario
A visitor receives an urgent meeting link and lands on a polished pre-join screen with camera controls, participant wording and a prominent “Join” button. Interaction then requests credentials, an extension, an update or a downloaded application.
Checks that expose the imitation
- The domain is not owned by the video-meeting provider it displays.
- The page combines several unrelated brands or uses assets from image-hosting services.
- The join action submits credentials to a different host or starts an unexpected download.
- The meeting identifier exists only in the page design and cannot be confirmed through the genuine service.
Why appearance is weak evidence
Meeting controls can be recreated with ordinary HTML and images. Radar should treat the visual resemblance as brand context, then corroborate it with hostname ownership, form destinations, redirects, downloads and runtime behaviour.
False-positive boundary
Organisations can legitimately embed meeting links in their own portals. An off-brand host should increase scrutiny, not automatically produce a malicious verdict. Stronger action requires a credential collector, deceptive download, known-malicious listing or another independent signal.
Recommended response
Open the meeting provider’s official application and enter the meeting identifier there. Do not install software or sign in through an unexpected invitation page.
Further reading: CISA phishing guidance.